
The UK High Court of Justice issued a landmark ruling against Sky Betting & Gaming, highlighting key privacy and data protection concerns within the online gambling industry.
The case, RTM v Bonne Terre Limited and Hestview Limited, was heard in the King’s Bench Division Media and Communications List and focused on claims of improper data use and intrusive marketing by Sky Betting & Gaming (SBG). Bonne Terre Limited, owned by Flutter Entertainment, and Hestview, acting as the company’s data controller, were at the center of the allegations.
The claimant, identified as “RTM,” a recovering online gambling addict, argued that SBG’s data processing and marketing practices worsened his compulsive gambling, causing significant financial and emotional harm. During 2017-2018, RTM deposited over £31,000 into his SBG account, far exceeding his income and household expenses. He accused SBG of using profiling algorithms to deliver personalised marketing campaigns that exploited his addiction with targeted offers and incentives.
The claimant also argued that SBG’s practices violated data protection and privacy laws. In response, the defendants denied the allegations, asserting that their data processing and marketing activities complied with legal standards. They claimed the claimant had provided valid consent for data use via cookie banners and user agreements. SBG highlighted its adherence to legal requirements and UK Gambling Commission (UKGC) regulations, though the regulator has previously taken enforcement action against the operator.
The case centered on key legal issues, including the lawfulness of data processing, adequacy of consent mechanisms, and adherence to principles of transparency, fairness, and purpose limitation. The court examined these under the Data Protection Act 1998, GDPR, PECR 2003, the Gambling Act 2005, and the Gambling Commission’s codes of practice.
A major question was whether SBG obtained lawful consent for cookies and personal data processing for targeted marketing. The court found SBG’s cookie banners and privacy notices during the relevant period insufficient to meet the legal standard for informed and specific consent. The claimant testified that he clicked through the banners without understanding their implications, focusing only on accessing the platform. The court highlighted that the design of the banners and privacy notices failed to provide clear, comprehensive information, violating Regulation 6 of PECR.
The judgment analyzed SBG’s use of profiling and data analytics for personalized marketing. The company relied on detailed behavioral data to segment customers and deliver frequent, targeted campaigns via emails and push notifications, aiming to boost engagement and spending.
While SBG argued that these practices were standard in the industry, the court emphasized the risks of marketing to individuals showing signs of gambling harm. Evidence revealed the claimant exhibited high-risk behaviors, including significant losses and escalating deposits, yet continued to receive targeted marketing communications.
The claimant also argued that SBG’s profiling activities involved sensitive data related to his mental health and gambling addiction. Under data protection law, such information is classified as special category data, requiring explicit consent for processing. The court found SBG failed to meet this standard, as the claimant was not adequately informed about the extent and purpose of the profiling.
The court also scrutinized SBG’s approach to balancing marketing practices with safer gambling obligations. While the company used a risk modeling system to identify high-risk customers, interventions like suspending marketing communications were only triggered when a customer’s risk score exceeded a specific threshold. Marketing continued unchanged for those below this threshold, even when their behavior indicated potential harm. The court noted that this binary approach overlooked the nuanced risks associated with gambling addiction.
The court ruled in favor of the claimant on two key issues: SBG’s collection of personal data via cookies and delivery of targeted marketing emails without valid consent. Justice Rice clarified that the decision applies only to the specific practices during the period under review. The issue of remedies was deferred for further consideration, with any compensation limited to clearly identified and quantified harm caused by SBG during the relevant period. Courts in similar cases have occasionally denied remedies, citing causation challenges, leaving the outcome on this matter pending further submissions.